Skip to content

Upgrading ws 6 to 7

Breaking6.2.6 → 7.5.13Breaking4Security5Platform1New5Changed2Fixed37

Full comparisonBack to ws
BreakingUpgrade verdict

3 breaking changes and a platform requirement change and 3 security fixes.

In plain terms
  • You can no longer pass a legacy url.Url object when creating a WebSocket; use a URL string or WHATWG URL instead.
  • Calling ping, pong, or send before the connection is open now throws, and calling them while closing or closed reports an error via callback instead of throwing.
  • If you call ping, pong, or send while the connection is still connecting, an exception is now thrown.
  • This version no longer runs on Node.js 6, so users on that version must upgrade Node.js.
Must act Top 5 of 7 that need code or config changes

Requires Node.js >=8.3.0 from 7.2.1 (none stated before).

Drops async-limiter.

Installs 0 packages in all (was 1).

What you must change

Breaking3
Removes support for url.Url instances in the WebSocket constructor.
WebSocket
7.0.0GitHub ReleaseSummarizedView source
Changes WebSocket#{ping,pong,send}() behavior when readyState is not OPEN.
WebSocket#ping()WebSocket#pong()WebSocket#send()readyStatebufferedAmount
7.0.0GitHub ReleaseSummarizedView source
Throws an exception when readyState is CONNECTING for ping, pong, or send.
readyState
7.0.0GitHub ReleaseSummarizedView source
Security3
ws: Memory exhaustion DoS from tiny fragments and data chunks
High · CVSS 7.5
7.5.11GitHub AdvisoryOriginalView source
ws affected by a DoS when handling a request with many HTTP headers
High · CVSS 7.5
7.5.10GitHub AdvisoryOriginalView source
ReDoS in Sec-Websocket-Protocol header
Sec-Websocket-ProtocolModerate · CVSS 5.3
7.4.6GitHub AdvisoryOriginalView source
Platform1
Drops support for Node.js 6.
7.0.0GitHub ReleaseSummarizedView source